Offline data protection method, device and storage medium

Abstract

The present invention relates to an offline data protection method, device and storage medium, which are applied to the field of offline data protection technology. The method comprises: encrypting exported Excel data by adopting a more secure SM4 encryption algorithm for file encryption. Compared with the existing symmetric encryption algorithm A, the SM4 encryption algorithm has higher security and anti-cracking capability, and its key management is more stringent. The method mainly stores the key generated by the encryption process in a hidden Excel worksheet, sets table protection and encrypts the content, thereby reducing the risk of key leakage; when exporting data in an offline state, the method automatically performs encryption processing by triggering a specific event, and generates an encrypted Excel file that can be used offline. Different data access permissions are set according to user roles and permission levels. Through permission verification and dynamic permission adjustment, the flexibility and security of data access are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of offline data protection, and in particular to an offline data protection method, device and storage medium. Background Art

[0002] With the development of information technology, Excel has become an important tool for daily data processing and analysis in enterprises and organizations. However, once data is exported from the system to Excel, it has multiple objective management and control shortcomings. These shortcomings may lead to problems in data security, integrity, and management efficiency.

[0003] A common encryption method in existing technologies is symmetric encryption algorithm A (such as AES), but its key distribution and storage are insecure, which can easily lead to key leakage, thereby exposing data to risks. Most existing technologies rely on encryption and permission management in online environments and cannot effectively achieve data protection in offline states. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide an offline data protection method, device and storage medium to solve the problem in the prior art that the distribution and storage of keys of common symmetric encryption algorithms are insecure, which easily leads to key leakage and thus puts data at risk, and the problem that the prior art relies on encryption and permission management in an online environment and cannot effectively realize data protection in an offline state.

[0005] According to a first aspect of an embodiment of the present invention, there is provided an offline data protection method, the method comprising:

[0006] Use standard library functions to implement the SM4 encryption algorithm and bind the encryption process to specific events, including file saving and file exporting;

[0007] Monitor the user's file saving or file exporting behavior, and when monitoring any user's file saving or file exporting specific events, trigger the encryption process through event driving;

[0008] Store the key generated during the encryption process in a hidden Excel worksheet, set table protection, and encrypt the content;

[0009] Record user information in the Excel hidden worksheet, the user information including user account, user password and permission level, the user password being the key generated during the encryption process; encrypt the user information using an encryption algorithm, and implement encrypted storage of the user information through a Cryptography object;

[0010] When any user accesses an encrypted worksheet, the user information is obtained and compared with the user information recorded in the Excel hidden worksheet. If there is a matching user information, the encrypted worksheet is unlocked; if there is no matching user information, all worksheets are locked and the system exits.

[0011] The user's permission level is obtained based on the user information. When the user performs a file operation included in the permission level, the worksheet is modified based on the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content remains unchanged.

[0012] Preferably,

[0013] The encryption process is triggered by event driving and includes:

[0014] If the file to be encrypted is cell data, the cell data is divided into blocks by row or column, each block is encrypted separately, and the encrypted data is stored back to the original location or written into a new worksheet to isolate the plaintext.

[0015] Preferably, it also includes:

[0016] Create a field in the Excel hidden worksheet to store the current access count and the maximum allowed count;

[0017] When any user accesses an encrypted worksheet, the Workbook_Open macro is used to automatically read the count. Each time the file is opened, the count is increased by one and written back to the current access count of the Excel hidden worksheet. It is determined whether the current access count exceeds the maximum allowed number of times. If so, all worksheets are locked and a message box is displayed to prompt.

[0018] Preferably, it also includes:

[0019] When the difference between the current number of accesses and the maximum allowed number of accesses is within a preset difference range, a message box is displayed to prompt the remaining number of accesses;

[0020] When the current access times reach the maximum allowed times and all worksheets are locked, the administrator password recovery function is retained to ensure that only permissions are unlocked.

[0021] Preferably, it also includes:

[0022] Record the file creation date field and the effective date field in the Excel hidden worksheet;

[0023] When any user accesses an encrypted worksheet, use the date function or the Workbook_Open macro to read the current time and compare it with the valid date field. If the current time exceeds the valid date field, the sensitive data is cleared or the file is re-encrypted, and an expiration message is displayed.

[0024] When the encrypted worksheet expires, an administrator password unlocking function is provided, or an effective date field is updated through an external tool.

[0025] Preferably, it also includes:

[0026] When any user exports a worksheet or switches worksheets, watermark content is dynamically generated and stored in the Excel hidden worksheet. The Shapes.AddTextEffect method is used to add the watermark content to the worksheet as a semi-transparent text object or the PageSetup.CenterHeader is used to set the watermark content as the background of the worksheet.

[0027] According to a second aspect of an embodiment of the present invention, there is provided an offline data protection device, the device comprising:

[0028] Encryption module: used to implement encryption algorithms using standard library functions and bind the encryption process to specific events, including file saving and file exporting;

[0029] Encryption trigger module: used to monitor the user's file saving or file exporting behavior. When monitoring any user's file saving or file exporting specific events, the encryption process is triggered through event-driven;

[0030] Key protection module: used to store the key generated during the encryption process in a hidden Excel worksheet, set table protection and encrypt the content;

[0031] Permission setting module: used to record user information in the Excel hidden worksheet, the user information including user account, user password and permission level, the user password is the key generated during the encryption process; encrypt the user information using an encryption algorithm and implement encrypted storage of the user information through a Cryptography object;

[0032] User information comparison module: used to obtain user information when any user accesses the encrypted worksheet, compare the user information with the user information recorded in the Excel hidden worksheet, and unlock the encrypted worksheet if there is a matching user information; if there is no matching user information, lock all worksheets and exit;

[0033] Permission determination module: used to obtain the user's permission level based on user information. When the user performs a file operation included in the permission level, the worksheet is modified according to the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content does not change.

[0034] According to a third aspect of an embodiment of the present invention, a storage medium is provided, wherein the storage medium stores a computer program, and when the computer program is executed by a host controller, each step in the above method is implemented.

[0035] The technical solutions provided by the embodiments of the present invention may have the following beneficial effects:

[0036] This application uses the more secure SM4 encryption algorithm to encrypt the exported Excel data. Compared with the existing symmetric encryption algorithm A, the SM4 encryption algorithm has higher security and anti-cracking capabilities, and its key management is more stringent. It mainly stores the key generated by the encryption process in a hidden Excel worksheet, sets table protection and encrypts the content, reducing the risk of key leakage; when exporting data offline, encryption is automatically performed by triggering specific events, and an encrypted Excel file that can be used offline is generated. Different data access permissions are set according to user roles and permission levels. Through permission verification and dynamic permission adjustment, the flexibility and security of data access are ensured.

[0037] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0039] Figure 1 is a flowchart illustrating an offline data protection method according to an exemplary embodiment;

[0040] Figure 2 is a system schematic diagram of an offline data protection device according to another exemplary embodiment;

[0041] In the attached figure: 1- encryption module, 2- encryption trigger module, 3- key protection module, 4- authority setting module, 5- user information comparison module, 6- authority determination module. DETAILED DESCRIPTION

[0042] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent like or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0043] Example 1

[0044] Figure 1 FIG. 1 is a flow chart showing an offline data protection method according to an exemplary embodiment. Figure 1 As shown, the method includes:

[0045] S1, using standard library functions to implement the SM4 encryption algorithm, binding the encryption process to specific events, including file saving and file export;

[0046] S2, monitoring the user's file saving or file exporting behavior, when monitoring any user's file saving or file exporting specific events, triggering the encryption process through event driving;

[0047] S3, stores the key generated by the encryption process in a hidden Excel worksheet, sets table protection and encrypts the content;

[0048] S4, recording user information in the Excel hidden worksheet, the user information including: user account, user password and permission level, the user password being the key generated during the encryption process; encrypting the user information using an encryption algorithm, and implementing encrypted storage of the user information through a Cryptography object;

[0049] S5, when any user accesses the encrypted worksheet, obtain user information, compare the user information with the user information recorded in the Excel hidden worksheet, and if there is matching user information, unlock the encrypted worksheet; if there is no matching user information, lock all worksheets and exit;

[0050] S6, obtaining the user's permission level based on the user information, and when the user performs a file operation included in the permission level, modifying the worksheet based on the user's operation behavior; if the user performs a file operation not included in the permission level, the worksheet content remains unchanged;

[0051] It is understood that encryption of offline data includes:

[0052] Use standard library functions to implement encryption algorithms, such as SM4 (National Commercial Encryption Algorithm), and process binary data through the ADODB.Stream module;

[0053] Trigger mechanism: Bind the encryption process to specific events (such as Workbook_BeforeSave or Workbook_BeforeClose), monitor the user's file saving or exporting behavior, and trigger the encryption process through event-driven (such as OnFileExport) to ensure real-time encryption when the file is exported;

[0054] Block encryption: When reading cell data (i.e., the data to be encrypted is relatively large), it is divided into blocks by row or column, and each block is encrypted separately to prevent memory usage problems caused by excessive data volume in the entire table. The encrypted data is then stored back to the original location or written to a new worksheet to isolate the plaintext.

[0055] Key storage and protection: The key is stored in a hidden Excel worksheet. Set table protection (hidden and read-only attributes) and encrypt the content. Access requires a user password to unlock.

[0056] This embodiment automatically performs encryption processing when exporting data and generates an encrypted Excel file that can be used offline. Even when the file is disconnected from the online system, it can still maintain high-strength encryption protection.

[0057] Permission Management:

[0058] Record the account number, password, and permission level in a hidden worksheet, encrypt the information using an encryption algorithm (such as AES), and implement encrypted storage through the Cryptography object;

[0059] Permission verification:

[0060] When the file is opened, a verification window (based on UserForm design) pops up through the Workbook_Open macro;

[0061] The user's entered account and password are matched using the same encryption logic. If the verification succeeds, the file's protection status is released; if it fails, all worksheets are locked and the file exits.

[0062] Clearance Level:

[0063] Use hidden tags (such as cell comments or dedicated worksheets) to record permission levels, dynamically adjust user operation scope (read-only, edit, export) based on permissions, and set password protection based on permissions;

[0064] Adjust permission levels in real time, for example, prohibit high-privilege users from arbitrarily lowering the permissions of other users;

[0065] This embodiment implements fine-grained permission control, supports setting different data access permissions based on user roles and permission levels, and ensures flexibility and security of data access through permission verification and dynamic permission adjustment.

[0066] Access limit:

[0067] Create fields in a hidden worksheet to store the current access count and the maximum allowed number of times, ensuring that users cannot view them directly. Use the Workbook_Open macro to automatically read the count, increment the count by one each time the file is opened, and write it back to the hidden worksheet.

[0068] Dynamic verification:

[0069] When opening a file, first check whether the current count has exceeded the limit. If so, lock all worksheets and display a message box (such as using MsgBox to notify the user). After the file is locked, retain the administrator password recovery function to ensure that only permissions are unlocked;

[0070] Prompt mechanism:

[0071] When approaching the maximum number of visits, a pop-up window will be displayed to remind you of the remaining available times;

[0072] When a user reaches the access limit, the file is locked and a notification is sent to the administrator;

[0073] This embodiment prevents excessive access and abuse of data by limiting the number of times users can access encrypted Excel files.

[0074] Document validity period limit:

[0075] Hide the file creation date and validity period in the worksheet to ensure they are not visible, and use date functions (such as Now()) to dynamically verify the current time;

[0076] Dynamic Validation:

[0077] When opening a file, the Workbook_Open macro is triggered to read the current time and compare it with the validity period field.

[0078] If it has expired, clear sensitive data (such as resetting cell contents) or encrypt the file and display an expiration prompt message;

[0079] Recovery mechanism after file expiration:

[0080] Provide administrator password unlocking function, or update the validity period field through external tools;

[0081] Support notification function to remind users that files are about to expire;

[0082] This embodiment sets a valid usage period for files to ensure that files automatically become invalid after the validity period has expired, thus preventing long-term abuse and data leakage.

[0083] Watermark display:

[0084] Dynamically embed watermarks in files to enhance copyright protection and accountability.

[0085] Watermark generation:

[0086] By dynamically generating watermark content (such as user name, export time, etc.) and storing it in a hidden worksheet, use the Shapes.AddTextEffect method to add the watermark as a semi-transparent text object, or set the background watermark through PageSetup.CenterHeader.

[0087] Irremovability:

[0088] Set the watermark object to locked state and combine it with worksheet protection to prevent users from deleting the watermark;

[0089] Macro program detects deletion attempts and logs tampering;

[0090] Dynamic display: trigger watermark redrawing in response to specific events (such as file opening or worksheet switching) to ensure it is always visible;

[0091] Watermark information is synchronized with server records to track file users;

[0092] This embodiment adds a watermark to the Excel file to display important copyright information and user information, thereby preventing data leakage and illegal dissemination.

[0093] Example 2

[0094] Figure 2 1 is a system diagram illustrating an offline data protection device according to another exemplary embodiment, the device comprising:

[0095] Encryption module 1: used to implement encryption algorithms using standard library functions and bind the encryption process to specific events, including file saving and file exporting;

[0096] Encryption trigger module 2: used to monitor the user's file saving or file exporting behavior, and trigger the encryption process through event-driven when monitoring any user's file saving or file exporting specific events;

[0097] Key protection module 3: used to store the key generated during the encryption process in a hidden Excel worksheet, set table protection and encrypt the content;

[0098] Permission setting module 4: used to record user information in the Excel hidden worksheet, the user information including user account, user password and permission level, the user password being the key generated during the encryption process; encrypt the user information using an encryption algorithm, and implement encrypted storage of the user information through a Cryptography object;

[0099] User information comparison module 5: used for obtaining user information when any user accesses the encrypted worksheet, comparing the user information with the user information recorded in the Excel hidden worksheet, and unlocking the encrypted worksheet if there is matching user information; otherwise, locking all worksheets and exiting;

[0100] Permission determination module 6: used to obtain the user's permission level based on user information. When the user performs a file operation included in the permission level, the worksheet is modified according to the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content does not change.

[0101] Example 3:

[0102] This embodiment provides a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a host controller, each step in the above method is implemented;

[0103] It is understandable that the storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0104] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0105] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" is at least two.

[0106] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0107] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0108] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0109] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.

[0110] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0111] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0112] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. An offline data protection method, characterized in that: The method comprises: Use standard library functions to implement the SM4 encryption algorithm and bind the encryption process to specific events, including file saving and file exporting; Monitor the user's file saving or file exporting behavior, and when monitoring any user's file saving or file exporting specific events, trigger the encryption process through event driving; triggering the encryption process through event driving includes: If the file to be encrypted is cell data, the cell data is divided into blocks by row or column, each block is encrypted separately, and the encrypted data is stored back to the original location or written into a new worksheet to isolate the plaintext; Store the key generated during the encryption process in a hidden Excel worksheet, set table protection, and encrypt the content; Record user information in the Excel hidden worksheet, the user information including user account, user password and permission level, the user password being the key generated during the encryption process; encrypt the user information using an encryption algorithm, and implement encrypted storage of the user information through a Cryptography object; When any user accesses an encrypted worksheet, the user information is obtained and compared with the user information recorded in the Excel hidden worksheet. If there is a matching user information, the encrypted worksheet is unlocked; if there is no matching user information, all worksheets are locked and the system exits. The user's permission level is obtained based on the user information. When the user performs a file operation included in the permission level, the worksheet is modified based on the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content remains unchanged.

2. The method according to claim 1, characterized in that Also includes: Create a field in the Excel hidden worksheet to store the current access count and the maximum allowed count; When any user accesses an encrypted worksheet, the Workbook_Open macro is used to automatically read the count. Each time the file is opened, the count is increased by one and written back to the current access count of the Excel hidden worksheet. It is determined whether the current access count exceeds the maximum allowed number of times. If so, all worksheets are locked and a message box is displayed to prompt.

3. The method according to claim 2, characterized in that Also includes: When the difference between the current number of accesses and the maximum allowed number of accesses is within a preset difference range, a message box is displayed to prompt the remaining number of accesses; When the current access times reach the maximum allowed times and all worksheets are locked, the administrator password recovery function is retained to ensure that only permissions are unlocked.

4. The method according to claim 3, characterized in that Also includes: Record the file creation date field and the effective date field in the Excel hidden worksheet; When any user accesses an encrypted worksheet, use the date function or the Workbook_Open macro to read the current time and compare it with the valid date field. If the current time exceeds the valid date field, the sensitive data is cleared or the file is re-encrypted, and an expiration message is displayed. When the encrypted worksheet expires, an administrator password unlocking function is provided, or an effective date field is updated through an external tool.

5. The method according to claim 4, characterized in that Also includes: When any user exports a worksheet or switches worksheets, watermark content is dynamically generated and stored in the Excel hidden worksheet. The Shapes.AddTextEffect method is used to add the watermark content to the worksheet as a semi-transparent text object or the PageSetup.CenterHeader is used to set the watermark content as the background of the worksheet.

6. An offline data protection device, characterized in that: The device comprises: Encryption module: used to implement encryption algorithms using standard library functions and bind the encryption process to specific events, including file saving and file exporting; The encryption trigger module is used to monitor the user's file saving or file exporting behavior. When monitoring any user's file saving or file exporting specific events, the encryption process is triggered by the event. The event-driven triggering of the encryption process includes: If the file to be encrypted is cell data, the cell data is divided into blocks by row or column, each block is encrypted separately, and the encrypted data is stored back to the original location or written into a new worksheet to isolate the plaintext; Key protection module: used to store the key generated during the encryption process in a hidden Excel worksheet, set table protection and encrypt the content; Permission setting module: used to record user information in the Excel hidden worksheet, the user information including user account, user password and permission level, the user password is the key generated during the encryption process; encrypt the user information using an encryption algorithm and implement encrypted storage of the user information through a Cryptography object; User information comparison module: used to obtain user information when any user accesses the encrypted worksheet, compare the user information with the user information recorded in the Excel hidden worksheet, and unlock the encrypted worksheet if there is a matching user information; if there is no matching user information, lock all worksheets and exit; Permission determination module: used to obtain the user's permission level based on user information. When the user performs a file operation included in the permission level, the worksheet is modified according to the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content does not change.

7. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the host controller, each step of the offline data protection method according to any one of claims 1 to 5 is implemented.

Images